- Arch-security - lists.archlinux.org

[arch-security] [ASA-201508-6] freeradius: insufficient CRL validation
by Remi Gacogne 14 Aug '15

14 Aug '15

Arch Linux Security Advisory ASA-201508-6 ========================================= Severity: Low Date : 2015-08-14 CVE-ID : CVE-2015-4680 Package : freeradius Type : insufficient CRL validation Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package freeradius before version 3.0.9-1 is vulnerable to insufficient CRL validation. Resolution ========== Upgrade to 3.0.9-1. # pacman -Syu "freeradius>=3.0.9-1" The problem has been fixed upstream in version 3.0.9 and 2.2.8. Workaround ========== The FreeRADIUS project advises to use self-signed CAs without intermediate CAs for EAP-TLS, as only intermediate CAs are apparently vulnerable to this issue. Description =========== The FreeRADIUS server relies on OpenSSL to perform certificate validation, including Certificate Revocation List (CRL) checks. The FreeRADIUS usage of OpenSSL, in CRL application, limits the checks to leaf certificates, therefore not detecting revocation of intermediate CA certificates. An unexpired client certificate, issued by an intermediate CA with a revoked certificate, is therefore accepted by FreeRADIUS. Impact ====== A remote attacker might be able to authenticate using a certificate signed by a revoked intermediate CA. References ========== http://freeradius.org/security.html http://www.ocert.org/advisories/ocert-2015-008.html https://access.redhat.com/security/cve/CVE-2015-4680

1 0

[arch-security] [ASA-201508-5] subversion: authentication bypass
by Remi Gacogne 14 Aug '15

14 Aug '15

Arch Linux Security Advisory ASA-201508-5 ========================================= Severity: Medium Date : 2015-08-14 CVE-ID : CVE-2015-3184 CVE-2015-3187 Package : subversion Type : authentication bypass Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package subversion before version 1.9.0-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 1.9.0-1. # pacman -Syu "subversion>=1.9.0-1" The problem has been fixed upstream in version 1.9.0, 1.8.14 and 1.7.21. Workaround ========== CVE-2015-3184 can be mitigated by disabling mixed anonymous/authenticated authz. There is no known workaround for CVE-2015-3187. Description =========== - CVE-2015-3184: Subversion's mod_authz_svn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4. The result is that anonymous access may be possible to files for which only authenticated access should be possible. - CVE-2015-3187: Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by path-based authz. When a node is copied from an unreadable location to a readable location the unreadable path may be revealed. This vulnerability only reveals the path, it does not reveal the contents of the path. Impact ====== A remote unauthenticated attacker may be able to access files that should be restricted to authenticated user. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3184 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3187 https://subversion.apache.org/security/CVE-2015-3184-advisory.txt https://subversion.apache.org/security/CVE-2015-3187-advisory.txt

1 0

[arch-security] [ASA-201508-4] firefox: multiple issues
by Remi Gacogne 12 Aug '15

12 Aug '15

Arch Linux Security Advisory ASA-201508-4 ========================================= Severity: Critical Date : 2015-08-12 CVE-ID : CVE-2015-4473 CVE-2015-4474 CVE-2015-4475 CVE-2015-4477 CVE-2015-4478 CVE-2015-4479 CVE-2015-4480 CVE-2015-4482 CVE-2015-4483 CVE-2015-4484 CVE-2015-4485 CVE-2015-4486 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489 CVE-2015-4490 CVE-2015-4491 CVE-2015-4492 CVE-2015-4493 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 40.0-1 is vulnerable to multiple issues, up to remote code execution. Resolution ========== Upgrade to 40.0-1. # pacman -Syu "firefox>=40.0-1" The problem has been fixed upstream in version 40.0. Workaround ========== None. Description =========== - CVE-2015-4473 (Memory safety bugs fixed in Firefox ESR 38.2 and Firefox 40): Gary Kwong, Christian Holler, and Byron Campen reported memory safety problems and crashes that affect Firefox ESR 38.1 and Firefox 39. - CVE-2015-4474 (Memory safety bugs fixed in Firefox 40): Tyson Smith, Bobby Holley, Chris Coulson, Byron Campen, and Eric Rahm reported memory safety problems and crashes that affect Firefox 39. - CVE-2015-4475 (out of bounds read at mozilla::AudioSink): Security researcher Aki Helin used the Address Sanitizer tool to discover an out-of-bounds read during playback of a malformed MP3 format audio file which switches sample formats. This could trigger a potentially exploitable crash or the reading of out-of-bounds memory content in some circumstances. - CVE-2015-4477 (MediaStream use-after-free): Security researcher SkyLined reported a use-after-free issue in how audio is handled through the Web Audio API during MediaStream playback through interactions with the Web Audio API. This results in a potentially exploitable crash. - CVE-2015-4478 (JSON.parse with reviver allows redefining non-configurable properties): Security researcher André Bargull reported non-configurable properties on JavaScript objects can be redefined while parsing JSON in violation of the ECMAScript 6 standard. This allows malicious web content to bypass same-origin policy by editing these properties to arbitrary values. - CVE-2015-4479 (MPEG4 saio Chunk Integer Overflow (libstagefright)): An anonymous researcher reported, via TippingPoint's Zero Day Initiative, reported two integer overflows that could be triggered by a malicious 'saio' chunk in an MPEG4 video, leading to potential arbitrary code execution. This issue was independently reported by security researcher laf.intel. - CVE-2015-4480 (crash in [@ stagefright::SampleTable::isValid() ] with h264 mp4): Security researcher Massimiliano Tomassoli discovered an integer overflow issue when parsing an invalid MPEG4 video. - CVE-2015-4482 (Out of bounds write in mar_read.c): Security researcher Holger Fuhrmannek reported that if the Updater opens a MAR format file with a specially crafted name, an out-of-bounds write will occur. This can lead to a potentially exploitable crash but requires that the malicious MAR format file be present on the local system and the Updater to be run to use it. - CVE-2015-4483 (feed: protocol + POST method => mixed scripting): Security researcher Masato Kinugawa reported that opening a target page using a POST to the url prefixed with the feed: protocol disables the mixed content blocker for that page. This could allow for the risk of a man-in-the-middle (MITM) scripting attack on pages that accidentally include insecure content which would otherwise be blocked. - CVE-2015-4484 (crash in void js::jit::AssemblerX86Shared::lock_addl<js::jit::Imm32>): Security researcher Jukka Jylänki reported a crash that occurs because JavaScript, when using shared memory, does not properly gate access to Atomics or SharedArrayBuffer views in some contexts. This leads to a non-exploitable crash. - CVE-2015-4485 (Heap-buffer-overflow WRITE in resize_context_buffers), - CVE-2015-4486 (Out of bounds read in decrease_ref_count): Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover two buffer overflow issues in the Libvpx library used for WebM video when decoding a malformed WebM video file. These buffer overflows result in potentially exploitable crashes. - CVE-2015-4487 (Overflow nsTSubstring::ReplacePrep causes memory-safety bugs in string library), - CVE-2015-4488 (StyleAnimationValue::operator= uses objects after delete on self-assignment), - CVE-2015-4489 (Self-assignment in nsTArray_Impl causes memory-safety bug): Security researcher Ronald Crane reported three vulnerabilities affecting released code that were found through code inspection. These included one use of unowned memory, one use of a deleted object, and one memory safety bug. These do not all have clear mechanisms to be exploited through web content but are vulnerable if a mechanism can be found to trigger them. - CVE-2015-4490 (Mozilla Content Security Policy allows for asterisk wildcards in violation of CSP specification): Mozilla security engineer Christoph Kerschbaumer reported a discrepancy in Mozilla's implementation of Content Security Policy and the CSP specification. The specification states that blob:, data:, and filesystem: URLs should be excluded in case of a wildcard when matching source expressions but Mozilla's implementation allows these in the case of an asterisk wildcard. This could allow for more permissive CSP usage than expected by a web developer, possibly allowing for cross-site scripting (XSS) attacks. - CVE-2015-4491 (gdk-pixbuf heap overflow and DoS affecting Firefox): Security researcher Gustavo Grieco reported a heap overflow in gdk-pixbuf affecting Linux systems using Gnome. This issue is triggered by the scaling of a malformed bitmap format image and results in a potentially exploitable crash. - CVE-2015-4492 (Use-after-free in XMLHttpRequest with shared workers): Security researcher Looben Yang discovered a use-after-free vulnerability when recursively calling .open() on an XMLHttpRequest in a SharedWorker. - CVE-2015-4493 (Stagefright: heap-buffer-overflow crash [@stagefright::ESDS::parseESDescriptor]): Mozilla security engineer Tyson Smith used the Address Sanitizer to find a buffer overflow when parsing an MPEG4 video with an invalid size in an ESDS chunk lead to memory corruption. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firef… https://access.redhat.com/security/cve/CVE-2015-4473 https://access.redhat.com/security/cve/CVE-2015-4474 https://access.redhat.com/security/cve/CVE-2015-4475 https://access.redhat.com/security/cve/CVE-2015-4477 https://access.redhat.com/security/cve/CVE-2015-4478 https://access.redhat.com/security/cve/CVE-2015-4479 https://access.redhat.com/security/cve/CVE-2015-4480 https://access.redhat.com/security/cve/CVE-2015-4482 https://access.redhat.com/security/cve/CVE-2015-4483 https://access.redhat.com/security/cve/CVE-2015-4484 https://access.redhat.com/security/cve/CVE-2015-4485 https://access.redhat.com/security/cve/CVE-2015-4486 https://access.redhat.com/security/cve/CVE-2015-4487 https://access.redhat.com/security/cve/CVE-2015-4488 https://access.redhat.com/security/cve/CVE-2015-4489 https://access.redhat.com/security/cve/CVE-2015-4490 https://access.redhat.com/security/cve/CVE-2015-4491 https://access.redhat.com/security/cve/CVE-2015-4492 https://access.redhat.com/security/cve/CVE-2015-4493

1 0

[arch-security] [ASA-201508-3] ppp: denial of service
by Remi Gacogne 11 Aug '15

11 Aug '15

Arch Linux Security Advisory ASA-201508-3 ========================================= Severity: Low Date : 2015-08-11 CVE-ID : CVE-2015-3310 Package : ppp Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ppp before version 2.4.7-2 is vulnerable to remote denial of service. Resolution ========== Upgrade to 2.4.7-2. # pacman -Syu "ppp>=2.4.7-2" The problem has not been fixed upstream yet. Workaround ========== This issue can be mitigated by disabling RADIUS authentication. Description =========== A buffer overflow has been found in the rc_mksid() function in plugins/radius/util.c in Paul's PPP Package (ppp). When the PID of the pppd process is greater than 65535, the computation of a start accounting message to the RADIUS server will crash the pppd server. Impact ====== A remote attacker can crash the pppd server. References ========== https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3310 http://www.openwall.com/lists/oss-security/2015/04/16/7 https://bugs.archlinux.org/task/44607 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=782450

1 0

[arch-security] [ASA-201508-2] wordpress: multiple issues
by Remi Gacogne 07 Aug '15

07 Aug '15

Arch Linux Security Advisory ASA-201508-2 ========================================= Severity: High Date : 2015-08-07 CVE-ID : CVE-2015-2213 CVE-2015-5730 CVE-2015-5731 CVE-2015-5732 CVE-2015-5733 CVE-2015-5734 Package : wordpress Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package wordpress before version 4.2.4-1 is vulnerable to multiple issues, including XSS and SQL injection. Resolution ========== Upgrade to 4.2.4-1>. # pacman -Syu "wordpress>=4.2.4-1" The problem has been fixed upstream in version 4.2.4. Workaround ========== None. Description =========== - CVE-2015-2213: SQL injection in comments ID. - CVE-2015-5730: Timing attack in widgets. - CVE-2015-5731: Denial of service by locking a post from being edited. - CVE-2015-5732, CVE-2015-5733 CVE-2015-5734: XSS. Impact ====== A remote attacker could lock a post from being edited, or compromise a site running wordpress. References ========== https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance… https://codex.wordpress.org/Version_4.2.4 https://access.redhat.com/security/cve/CVE-2015-2213 https://access.redhat.com/security/cve/CVE-2015-5730 https://access.redhat.com/security/cve/CVE-2015-5731 https://access.redhat.com/security/cve/CVE-2015-5732 https://access.redhat.com/security/cve/CVE-2015-5733 https://access.redhat.com/security/cve/CVE-2015-5734

1 0

[arch-security] [ASA-201508-1] firefox: local file stealing via PDF reader
by Remi Gacogne 07 Aug '15

07 Aug '15

Arch Linux Security Advisory ASA-201508-1 ========================================= Severity: Critical Date : 2015-08-07 CVE-ID : CVE-2015-4495 Package : firefox Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 39.0.3-1 is vulnerable to local file stealing. Resolution ========== Upgrade to 39.0.3-1. # pacman -Syu "firefox>=39.0.3-1" The problem has been fixed upstream in version 39.0.3. Workaround ========== This issue can be mitigated by disabling the built-in PDF viewer, PDF.js. This can be done by typing about:config in the address bar, pressing Enter, looking for the pdfjs.disabled value and setting it to True by right-clicking on the line and left-clicking "Toggle". Note that accessing the about:config page might trigger a "This might void your warranty!" warning, easily dismissed by clicking on the "I'll be careful, I promise!" button. Description =========== Security researcher Cody Crews reported on a way to violate the same origin policy and inject script into a non-privileged part of the built-in PDF Viewer. This would allow an attacker to read and steal sensitive local files on the victim's computer. Mozilla has received reports that an exploit based on this vulnerability has been found in the wild. Impact ====== A remote attacker can craft a malicious web page stealing arbitrary files from the host running firefox. Mozilla reports that this flaw is already exploited in the wild. At least one exploit is targeting Linux and reads /etc/passwd, then in all the user directories it can access looks for .bash_history, .mysql_history, .pgsql_history, .ssh configuration files and keys, configuration files for remina, Filezilla, and Psi+, text files with “pass” and “access” in the names, and any shell scripts. References ========== https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-w… https://www.mozilla.org/en-US/security/advisories/mfsa2015-78/ https://access.redhat.com/security/cve/CVE-2015-4495 https://access.redhat.com/articles/1563163

1 0

[arch-security] [ASA-201507-23] pacman: silent downgrade
by Levente Polyak 29 Jul '15

29 Jul '15

Arch Linux Security Advisory ASA-201507-23 ========================================== Severity: High Date : 2015-07-29 CVE-ID : None Package : pacman Type : silent downgrade Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package pacman before version 4.2.1-2 is vulnerable to silent downgrade via a man-in-the-middle attack. Resolution ========== Upgrade to 4.2.1-2. # pacman -Syu "pacman>=4.2.1-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A flaw has been discovered in pacman that is leading to possible silent package downgrade when exploited. While loading each package it was not ensured that the internal version matches the expected database version, leading to the possibility to circumvent the version check. This issue can be used by an attacker to trick the software into installing an older version. This behavior can be exploited by a man-in-the-middle attack through specially crafted database tarball containing a higher version, yet actually delivering an older and vulnerable version, which was previously shipped. Impact ====== A remote attacker able to perform a man-in-the-middle attack is able to make use of a specially crafted database tarball to silently install an older and vulnerable version of a previously shipped package. References ========== https://lists.archlinux.org/pipermail/pacman-dev/2015-July/020238.html https://bugs.archlinux.org/task/45687

1 0

[arch-security] [ASA-201507-22] bind: denial of service
by Levente Polyak 29 Jul '15

29 Jul '15

Arch Linux Security Advisory ASA-201507-22 ========================================== Severity: High Date : 2015-07-29 CVE-ID : CVE-2015-5477 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package bind before version 9.10.2.P3-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.2.P3-1. # pacman -Syu "bind>=9.10.2.P3-1" The problem has been fixed upstream in version 9.10.2.P3. Workaround ========== None. Description =========== A flaw was found in the way BIND handled requests for TKEY DNS resource records. A remote attacker could use this flaw to make named (functioning as an authoritative DNS server or a DNS resolver) exit unexpectedly with an assertion failure via a specially crafted DNS request packet leading to denial of service. Impact ====== A remote attacker is able to trigger an assertion failure via a specially crafted DNS request packet that is resulting in unexpected application crash leading to denial of service. References ========== https://kb.isc.org/article/AA-01272/0 https://access.redhat.com/security/cve/CVE-2015-5477

1 0

[arch-security] [ASA-201507-21] qemu: multiple issues
by Levente Polyak 29 Jul '15

29 Jul '15

Arch Linux Security Advisory ASA-201507-21 ========================================== Severity: Critical Date : 2015-07-29 CVE-ID : CVE-2015-3214 CVE-2015-5154 CVE-2015-5158 Package : qemu Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package qemu before version 2.3.0-5 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 2.3.0-5. # pacman -Syu "qemu>=2.3.0-5" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2015-3214 (information disclosure, arbitrary code execution) An out-of-bounds memory access flaw, leading to memory corruption or possibly an information leak, was found in QEMU's pit_ioport_read() function. A privileged guest user in a QEMU guest, which had QEMU PIT emulation enabled, could potentially, in rare cases, use this flaw to execute arbitrary code on the host with the privileges of the hosting QEMU process. - CVE-2015-5154 (arbitrary code execution) A heap overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands. A privileged guest user in a guest with CDROM drive enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest. - CVE-2015-5158 (denial of service) This is a guest-triggerable buffer overflow. The scsi_cdb_length returns -1 as an error value, but the caller does not check it. Luckily, the massive overflow means that QEMU will just SIGSEGV, leading to denial of service of the guest system. Impact ====== A remote attacker is able to execute arbitrary code and take over the qemu process elevating its privilege to that of the qemu process or perform a denial of service attack to crash the guest system. References ========== http://xenbits.xen.org/xsa/advisory-138.html https://access.redhat.com/security/cve/CVE-2015-3214 https://access.redhat.com/security/cve/CVE-2015-5154 https://access.redhat.com/security/cve/CVE-2015-5158 https://github.com/qemu/qemu/commit/d4862a87e31a https://github.com/qemu/qemu/commit/c170aad8b057 https://github.com/qemu/qemu/commit/d2ff85854512 https://github.com/qemu/qemu/commit/cb72cba83021 https://github.com/qemu/qemu/commit/03441c3a4a42

1 0

[arch-security] [ASA-201507-20] crypto++: private key recovery
by Levente Polyak 24 Jul '15

24 Jul '15

Arch Linux Security Advisory ASA-201507-20 ========================================== Severity: Medium Date : 2015-07-24 CVE-ID : CVE-2015-2141 Package : crypto++ Type : private key recovery Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package crypto++ before version 5.6.2-3 is vulnerable to private key recovery via a timing side-channel attack. Resolution ========== Upgrade to 5.6.2-3. # pacman -Syu "crypto++>=5.6.2-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Evgeny Sidorov discovered that it is possible to recover the private key when using Rabin-Williams signatures due to a bad interaction with the blinding value used to mask private key operations. The bad interaction had to do with the random value not meeting certain Jacobi requirements, which allows remote attackers to obtain private keys via a timing attack. Impact ====== A remote attacker is able to take advantage of improper private key blinding operations to recover private keys via a timing side-channel attack. References ========== https://lists.ubuntu.com/archives/ubuntu-devel-discuss/2015-June/015585.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-2141 https://bugs.archlinux.org/task/45498

1 0